While not immediately applicable, the timers behave in a similar way on the F103 in the original Espruino board, so with the work you've done peeking all the register values, you should be able to get something working pretty quickly.

isTimerEnabled3.js has expanded to cover timers 1 thru 14.
Toffset.xlsx compares the four kinds of timer register offsets over the range of timers 1 thru 14. This was used to build the switch statement in isTimerEnabled3.js
ESpPinsTimers.xlsx shows the results of scans using isTimerEnabled.js one pin at a time. The procedure used: 1. Disconnect WebIDE, 2. Push reset button, 3. Reconncect WebIDE, 4. Edit analogWrite command line (169..172) in isTimerEnabled and 5. Load and run the program and note the results

Using Poke to Do PWM on Pins A0, A1, A2, and A3
Before trying to configure a timer into other modes of operation using poke commands, it would be useful to configure a timer using a known configuration created by the command analogWrite(A0,0.2,{ freq : 50 });
A known configuration:
If we modify isTimerEnabled3.js lines 168 thru 172 to read:

The attached file PokeA0Timer5a.js contains the code to implement pins A0, A1, A2, A3 on timer 5 using poke commands. Note that either powering the board off or using the reset button will clear the timer settings.
First setup the pins for alternate function output:

Note the frequency is determined by the ARR, and PSC registers and can be modified by the CR1 register.
Additionally the frequency depends on the clock chain see Figure 8 on page 92 of the RM0008 Reference manual. The register APB1 controls the prescaler for timers 2, 3 , 4, 5, 6, 7, 12, 13, and 14. The register APB2 controls the prescaler for timers 1, 8, 9, 10, and 11.

The CCMR1 and CCMR2 registers configure the CC (capture/compare) pins of the timer as output or input on one of three sources.

The CCER register configures the polarity and enable that connects to the pins A0..A3.

Thanks for the feedback Gordon. It may be a bit premature for a module as there are other examples in the documentation to work through and a need to make the code a bit more generalized. For example the previous code that measures frequency may be more accurate if two timers are chained together, where one does the counting and the other does the time base gating of the first.

Powering and Resetting Timers
So far programs in this project have been aimed at a specific timer and purpose. At this point I want to shift to a more generalized approach.
To clarify powering a timer consists of turning on the clock to the timer using a bit in either the APB1ENR or APB2ENR registers.
Resetting a timer consist of setting and resetting a bit in the APB1RSTR or APB2RSTR
The attached program TimOnOff.js implements these functions.
If a timer is off and attempts to write to the timer registers, they return zero values when read back. The program loops thru timers 1 to 14 and reports if the timer is on, it then turns on the timer and resets it. It reports if the timer is enabled and then disables the timer.
It write a unique value to the timer’s CNT counter register and reads it back.
If the program is run after a fresh power up of the board reports timers 1 thru 8 as off and is able to write and read the CNT register. A subsequent run of the program without a hard reset reports timers 1 thru 8 as on.
Timers 9, 10, and 11 have been omitted from the disable, write CNT as doing so crashes the Espruino board. The CNT read produces non-zero values. These timers do not report a power on. Additionally if the isTimerEnabled function uses a peek16 command the value returned in bit 0 is different than when a peek32 command is used.
Timers 12, 13, and 14 do not seem to be present on the Espruino board.
One of the difficulties is that the RM0008 Reference manual is written to cover a range of ARM chips with different sets of capabilities.
From the experimental evidence confining future progress should be aimed at timers 1 through 8.

Output of TimOnOff.js

Timer 0 out of bounds 1..14
Timer 0 out of bounds 1..14
Timer 0 out of bounds 1..14
Timer 0 out of bounds 1..14
Timer 0 out of bounds 1..14
Timer 0 out of bounds 1..14
Timer 0 out of bounds 1..14
0
Timer 0 out of bounds 1..14
1 is off
Timer 1 Disabled
ff01
1 is on
2 is off
Timer 2 Disabled
ff02
2 is on
3 is off
Timer 3 Disabled
ff03
3 is on
4 is off
Timer 4 Disabled
ff04
4 is on
5 is off
Timer 5 Disabled
ff05
5 is on
6 is off
Timer 6 Disabled
ff06
6 is on
7 is off
Timer 7 Disabled
ff07
7 is on
8 is off
Timer 8 Disabled
ff08
8 is on
9 is off
Timer 9 Enabled
14c2409
9 is off
10 is off
Timer 10 Enabled
1502409
10 is off
11 is off
Timer 11 Enabled
1542409
11 is off
12 is off
Timer 12 Disabled
0
12 is off
13 is off
Timer 13 Disabled
0
13 is off
14 is off
Timer 14 Disabled
0
14 is off
Timer 15 out of bounds 1..14
Timer 15 out of bounds 1..14
Timer 15 out of bounds 1..14
Timer 15 out of bounds 1..14
Timer 15 out of bounds 1..14
Timer 15 out of bounds 1..14
Timer 15 out of bounds 1..14
0
Timer 15 out of bounds 1..14

UpCounter.js A 16bit Up Counter Module
Place UpCounter.js in the modules folder of your WebIDE project.
Place the TestUpCounterTXChX.js files in the projects folder
For timers 1, 2, 4, and 5 pin B0 is used as a signal source for testing.
For timer 3 Pin A0 is used as a signal source for testing.
For example running TestUpCounter T5Ch1.js produces the following output.
Note that the timer input pin is the first thing displayed. For testing connect the signal source pin to the timer input pin. Use ClearInterval() to stop the program.

To setup several counters on different timers you only need one instance of UpCounter.

The file Tremap.xlsx shows the pins associated with the timers. It is possible to remap the pins by writing to the remap register. There are unknown pin assignments marked with a question mark. So far I haven’t located a document that gives the pinout of the timers.
The timers have four channels. The registers CCMR1 and CCMR2 allow the configuration of the 4 channels. The register SMCR only allows channels 1 and 2 and not 3 and 4.

Thanks for the encouragement. Making a module makes sense. Since my last post I've managed to chain timer 1 and 2 together to do a 32bit counter. I'm working on making it work using any two timers. Future work is mode 2 counting, a one time pulse timer, chaining the OTP to gate a counter, the capture modes that measure a pulse, encoder mode for a shaft encoder, and finally the motor control mode for timers 1 and 8. Lots of work. Maybe more than one module. The biggest headache is determining the pin out of the timers as it is not well documented.

4Jun2016 UpCounterV1.js
The previous Upcounter.js has been extended.
The Pins table has entries for Timer 8 channels added.
The setupCounter() function has dropped the prescale argument as it is not active.
A new function has been added. UpCounter.prototype.setupCounter32=funct­ion(Mtim,Mchan,Mfilter,Stim);
It allows two timers to be chained together to form a 32 bit counter.
The master timer (Mtim) is used to input an external signal on Mchan (1 or 2) and be filtered by Mfilter. When the Mtim overflows the slave timer (Stim) count is incremented. Mtim acts as a 16 bit prescaler to Stim
The count value (CNT) from Mtim is the LSB and the CNT value from STM is the MSB part of the count.

The Mfilter argument is discussed on pages 342 and 406. Value can range from 0 thru 15 with 0 being no filtering. It inserts a delay that acts as a de-bounce of a noisy signal.
In sections 14.4.3 TIM1&TIM8 slave mode control register (TIMx_SMCR) and 15.4.3 TIMx slave mode control register (TIMx_SMCR)

The counters so far are based on pages 377 and 378 of the RM0008 Reference manual
External clock source mode 1.

Pages 379 and 380 discuss External clock source mode 2. The problem is associating the ETR to a pin on the Espruino board. This will entail setting up mode 2 and trying all the pins until the one that works for each timer. Using the ETR as an external input allows the timer to operate in gated mode. A second timer can be used to generate a one time pulse to gate the first timer for a more precise measurement of frequency.

Place UpcounterV1.js in the modules folder of a WebIDE project and the remaining js files in the project folder.
The reader can test these functions by modifying the timer numbers and channel numbers in the test programs. I encourage readers to try the variations and report any problems. An external connection between the timer3 PWM output on pin B0 and the input pin of the counter is required.

I guess it should be possible to obtain the memory offsets of the timer registers for specific boards from the Espruino firmware since functions like digitalPulse use them anyway. Any ideas how to do that?